REST Authentication with Saas

Kinetic ERP
1

I’ve never been a security guy…now that that’s out of the way

I have a couple of standalone apps I have written that use REST calls to Epicor and are using “Basic Authentication” meaning I have to pass username and login on every call, which seems to work fine but feels clunky to me.

I’ve seen other posts that talk about different types of authentication when using the REST api, but it’s not clear what option I should use if we are Saas hosted.

Do I just use the “Azure Active Directory Authentication” ?

Described around page 78 of this document: Sign In

thx, Scott

2

Wouldn’t you have to have that set up in your environment to use that as the authentication method?

3

Honestly I don’t know, which is why I am reaching out :person_shrugging:

4

You only need to use basic auth on your call to the token service (which shouldn’t be exposed publicly). From that point on, use the token service to generate bearer tokens for continued authorization.

Code examples here: https://erphelp112300.zendesk.com/hc/en-us/articles/16639963843213-Setting-Up-Data-Security (you’ll need to be logged in to Epicor for the link to work, or simply search REST Services Guide within Kinetic, then in help navigate to Troubleshooting & Security > Setting Up Data Security).

5

Thank you, I believe that is what I was looking for, about to give it a try

6

Since he is SaaS, it would be exposed publicly. He can still use the Token Service but authenticate using Epicor IdP or Entra ID - the artist formerly known as Azure Active Directory. This would give them MFA as well as other goodies not available with phishing-prone usernames and passwords.

1 Like
7

a little stuck obtaining the token, getting this error:
(code from the rest services documentation obtaining a token)

image

Type or Namespace TokenObject could not be found

A quick search online did not help

( @Mark_Wonsil I will try to explore Epicor IdP or Entra ID next, but I thought this was a good step for my security understanding, as I mentioned I’m no security guy)

8

@spaceage Chris, did you implement this, I’m struggling with the “TokenObject” in the ReadAsAsync call when obtaining token (see above), thx

9

I did not, sorry Scott.